Cloudanix VulnDB

CVE-2026-90315

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A missing security check lets an administrator bypass protections meant to stop tampering with critical hardware settings on locked-down computers.

Exploitation
Local Privilege
Attacker needs
High Privilege
Complexity
Low
Impact
Privilege Gain
Component
OS kernel
Class
Authorization Bypass
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing security_locked_down(LOCKDOWN_PCI_ACCESS) checks in pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io() allow root to perform arbitrary I/O port writes and memory mappings on legacy PCI resources even when the kernel lockdown is active.

Why it matters to the business

Locked-down systems intended to block low-level hardware tampering remain exposed, increasing the chance of kernel memory corruption, unauthorized DMA, or persistent compromise on servers and embedded devices that rely on lockdown for integrity.

How an attack unfolds

An attacker obtains root, confirms the kernel is in lockdown mode, then directly writes to the legacy_io or legacy_mem sysfs files to issue I/O operations or map memory regions that the lockdown policy was designed to block, achieving the same hardware access that earlier patches restricted for config and BAR resources.

How to fix it

Apply the upstream patch that adds the missing LOCKDOWN_PCI_ACCESS checks to the legacy handlers; rebuild and deploy the updated kernel on all affected systems.

How to confirm the fix worked

Confirm the patched kernel source contains the security_locked_down calls in pci_write_legacy_io, pci_mmap_legacy_mem, and pci_mmap_legacy_io; test that attempts to access the files while lockdown is active return EPERM.

Typical attack path

  1. Gain root privileges on the target system
  2. Verify kernel lockdown is enabled via /sys/kernel/security/lockdown
  3. Locate and open /sys/devices/.../legacy_io or legacy_mem files
  4. Issue write or mmap operations to perform unauthorized port I/O or memory access
  5. Leverage resulting hardware control to modify kernel code or exfiltrate data

How to detect it

Review kernel audit logs and sysfs access attempts around legacy_io and legacy_mem paths; correlate with processes running as root during lockdown enforcement windows.

What your security team should do

  • Prioritize kernel updates on any system enforcing lockdown (UEFI Secure Boot, IMA, etc.)
  • Audit sysfs exposure of PCI legacy files via mandatory access controls or SELinux policies
  • Monitor for future kernel releases that backport this fix to supported LTS branches

The record

In the Linux kernel, the following vulnerability has been resolved: PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down. Commit eb627e17727e ("PCI: Lock down BAR access when the kernel is locked down") added the check to pci_write_config(), pci_mmap_resource(), and pci_write_resource_io() to prevent userspace from programming DMA-capable hardware that could be used to modify kernel code, but did not cover the legacy handlers. As a result, root can still write arbitrary I/O ports and map the legacy I/O and memory spaces while the kernel is locked down, which is the same capability the lockdown is meant to remove. Add the same check to pci_write_legacy_io(), pci_mmap_legacy_mem(), and pci_mmap_legacy_io(). These generic handlers cover both architectures that define HAVE_PCI_LEGACY (such as Alpha and PowerPC). [bhelgaas: add Link]

Affected packages

Ecosystem Package Introduced Fixed